96c07e39cd654a7bbbae2aed0f3badd872d030d96fcd3b6635500e8ba5ab237b

Analysis

max time kernel
41s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 09:50

Target

2581c14068315c6a67efdd05af60c6e9_JaffaCakes118.dll
Size

102KB
MD5

2581c14068315c6a67efdd05af60c6e9
SHA1

197589a1d6f4afe5230e82b646eb292433a5b14b
SHA256

96c07e39cd654a7bbbae2aed0f3badd872d030d96fcd3b6635500e8ba5ab237b
SHA512

c5db1a1ed0aed9f3019b77e3ac222fa6eaf5f5e8db9b473000bb9909a585add338f71b1c50c7f7d76158d743b853d45224eb36ebf43f3665f1b13ca0abfc1743
SSDEEP

3072:JGl6VMPBJLDMrsnhPSELX644nOo+iywQoE7j:ElTpdM+aQ6hTUo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	4184	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4184	4376	regsvr32.exe	80
PID 4376 wrote to memory of 4184	4376	regsvr32.exe	80
PID 4376 wrote to memory of 4184	4376	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2581c14068315c6a67efdd05af60c6e9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2581c14068315c6a67efdd05af60c6e9_JaffaCakes118.dll
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 596
    3⤵
    - Program crash
    PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4184 -ip 4184
1⤵
PID:4896

memory/4184-1-0x0000000000445000-0x0000000000446000-memory.dmp

Filesize
4KB

Download
memory/4184-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download